DNSSEC & DANE works now perfectly and new valid TLS certificates have been installed on both MX mail servers.
Additionally the mail servers are using too the DANE technology for connections to other SMTP server.

As Posteo.de supports now DANE, it has been set that mails which will be forwarded to Posteo.de will use DANE only, or be deferred (and then rejected).

Next step will be to migrate all other TrashMail domains to our DNSSEC name servers and to provide TLSA records to be DANE compliant too.